binary-tools/docs/PRIVACY-SECURITY.md

Privacy and security

Processing is local and in-memory. The CSP permits connections only to the current origin; the app itself performs none. No telemetry, cookies, persistence, service APIs or remote assets are used. The service worker caches only same-origin application assets.

Untrusted byte streams are bounded to 1 MiB. Structural traversal is limited to depth 64 and 10,000 nodes; the deliberately quadratic Base58 path is limited to 4 KiB. ASN.1 support is DER TLV inspection, not BER/CER. Protobuf support handles wire types 0, 1, 2 and 5; schemas are inert JSON and cannot load code.